CVE-2013-0156

Rails YAML deserialization RCE CVE-2013-0156 - Compatible con PentesterLab Versión compatible con Ronin-free y Ruby 3.x de https://gist.github.com/postmodern/4499206 Uso: ruby railsrce.rb http://target/ "system'/usr/local/bin/score UUID'" ⚠️ AVISO LEGAL ⚠️ Este script es SOLO PARA FINES EDUCATIVOS...

CVE-2026-76461

CVE-2026-76461 Un laboratorio de Python intencionalmente vulnerable y solo local para aprender cómo la deserialización insegura de YAML puede convertirse en una vía de ejecución de código. Incluye tres niveles de dificultad, una aplicación de comparación parcheada, scripts de explotación, pistas,...

CVE-2022-47986

CVE-2022-47986 Por qué Esta vulnerabilidad se explota activamente. IceFire utiliza esta vulnerabilidad para desplegar el ransomware en sistemas objetivo. Me gustaría ayudar a los equipos de SOC/Blue a identificar los sistemas afectados y a los Pentesters/Red a explotarla y reportarla. Descripción...

CVE-2020-1947

CVE-2020-1947 ApacheShardingShpereUIYAML análisis y reproducción de vulnerabilidad de ejecución remota de código Resumen shardingsphere es un ecosistema de código abierto de Apache, un conjunto de soluciones middleware para bases de datos distribuidas, compuesto por tres frameworks independientes...

CVE-2021-46364

CVE-2021-46364: YAML Deserialization in Magnolia CMS Magnolia versions =6.2.3 has a Snake YAML parser which is vulnerable to deserialization attacks that can allow an attacker to call arbitrary Java constructors when importing YAML files. Remote Code Execution has been achieved using this...

CVE-2022-31691

CVE-2022-31691 Un análisis de mi hasta ahora inconcluyente investigación sobre CVE-2022-31691. Antecedentes Soy usuario frecuente de Spring Tool Suite STS para Eclipse y suelo confiar en él para inicializar nuevos proyectos Spring Boot. Esta vulnerabilidad ver...

CVE-2025-56815

CVE-2025-56815 Datart 1.0.0-rc.3 es vulnerable a Directory Traversal en la interfaz POST /viz/image, ya que el servidor utiliza directamente MultipartFile.transferTo para guardar el archivo subido en una ruta controlable por el usuario y carece de una verificación estricta del nombre de archivo...

CVE-2021-41078

CVE-2021-41078 nameko Ejecución de código arbitrario debido a deserialización YAML Descripción NVD Nameko hasta la versión 2.13.0 puede ser engañado para ejecutar código arbitrario al deserializar el archivo de configuración. Demostración Configuración 1. Construir una imagen a partir de un...

CVE-2013-0156

Referencia del Script Original Para más detalles sobre el script de exploit original, consulta el enlace gist CVE-2013-0156 Script de Explotación CVE-2013-0156 Este script está diseñado específicamente para resolver el desafío en PentesterLab para el exploit CVE-2013-0156. Puedes acceder al desaf...

Exploit for SQL Injection in Cisco Asyncos

CVE-2026-76461 Vulnerability Exercise This project contains a...

CVE-2026-55887 MCP Gateway: Argument injection via OCI image label YAML in Docker MCP Gateway

MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structure for direct docker:// references and catalog snapshot...

CVE-2026-55887 MCP Gateway: Argument injection via OCI image label YAML in Docker MCP Gateway

MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structure for direct docker:// references and catalog snapshot...

CVE-2026-55887 MCP Gateway: Argument injection via OCI image label YAML in Docker MCP Gateway

MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structure for direct docker:// references and catalog snapshot...

CVE-2026-76595

A flaw was found in advisor-backend. Multiple code paths within the application deserialize YAML YAML Ain't Markup Language with an unsafe full Loader, which can instantiate arbitrary Python objects via YAML tags. An unauthenticated remote attacker can exploit this by submitting specially crafted...

CVE-2026-76594

A flaw was found in advisor-backend. A network-adjacent unauthenticated attacker could exploit a vulnerability in the /private/importcontent/ endpoint, which lacks proper authentication and permission checks. This allows the attacker to overwrite the global Advisor rule, resolution, and playbook...

CVE-2026-84202 ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading

ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users...

Arbitrary Code Injection

Overview modelscope is a ModelScope: bring the notion of Model-as-a-Service to life. Affected versions of this package are vulnerable to Arbitrary Code Injection due to unsafe YAML deserialization in the model configuration loading paths in modelscope/models/audio/tts/voice.py and...

CVE-2026-84202 ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading

ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users...

CVE-2026-84202

ModelScope (through v1.40.0 ) uses PyYAML's unsafe yaml.Loader to parse model configuration files, enabling arbitrary code execution via Python object construction tags. An attacker can craft a malicious model repository with a poisoned configuration file that executes code when a user loads the ...

CVE-2026-84202 ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading

ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users...